Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| directory listing in https://demo.owncloud.org/doc/#105149 | Valid | ownCloud | Information Disclosure | – | 2016-01-01 | – | – |
| Potential for Double Spend via Sign Message Utility#106315 | Informative | Coinbase | Cryptography | – | 2016-01-06 | – | – |
| Format string vulnerability in zend_throw_or_error()#106548 | Valid | Internet Bug Bounty | Command and Code Injection | – | 2016-01-10 | $1,000 | – |
| [cfire.mail.ru] Time Based SQL Injection#107780 | No longer public | Mail.ru | SQL Injection | – | 2016-01-15 | $150 | – |
| [https://test1.owncloud.com/owncloud6/] Guessable password used for admin user#107849 | Valid | ownCloud | No weakness recorded | – | 2016-01-02 | – | – |
| otrs.owncloud.com: Reflected Cross-Site Scripting#108288 | Valid | ownCloud | Cross-site Scripting | – | 2016-02-10 | – | – |
| Mixed Active Scripting Issue on stats.owncloud.org#108692 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-06 | – | – |
| Use After Free in sortWithSortKeys()#109175 | Valid | Internet Bug Bounty | Memory Corruption | – | 2016-01-20 | $1,000 | – |
| Extended policy checks are buggy#109959 | Valid | Phabricator | No weakness recorded | – | 2016-01-11 | – | – |
| The csrf token remains same after user logs in#111262 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-25 | – | – |
| Stored XSS#112025 | Informative | Udemy | Cross-site Scripting | – | 2016-02-22 | – | – |
| owncloud.help: Text Injection#112304 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-01-23 | – | – |
| [afisha.mail.ru] SQL Injection#112555 | No longer public | Mail.ru | SQL Injection | – | 2016-02-01 | $300 | – |
| Remote Server Restart Lead to Denial of Server by only one Request.#114125 | No longer public | Keybase | Denial of Service | – | 2016-02-06 | $250 | – |
| XSS via modified Zomato widget (res_search_widget.php)#115402 | Valid | Eternal | Cross-site Scripting | – | 2016-03-11 | – | – |
| nginx SPDY heap buffer overflow for https://grtp.co/#116352 | Informative | Gratipay | Memory Corruption | None | 2016-02-15 | – | – |
| proxy port 7000 and shell port 514 not filtered#116618 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2016-02-20 | – | – |
| server calendar and server status available to public#116621 | Informative | Gratipay | Information Disclosure | None | 2016-02-20 | – | – |
| UDP port 5060 (SIP) Open#116774 | Informative | Gratipay | Denial of Service | None | 2016-02-16 | – | – |
| MISSING SPF RECORDS & MISSING DKIM POLICY#117818 | Informative | LeaseWeb | Memory Corruption | – | 2016-02-22 | – | – |
| Reflected Cross Site scripting Attack (XSS)#150837 | No longer public | OLX | Cross-site Scripting | – | 2016-10-20 | – | – |
| DOS in browser using window.print() function#176364 | Informative | Brave Software | Denial of Service | – | 2016-10-20 | – | – |
| Not using Binary::safe* functions for substr/strlen function#181315 | Valid | Paragon Initiative Enterprises | No weakness recorded | – | 2016-11-13 | – | – |
| Cross Site Scripting#16417 | No longer public | Mail.ru | Cross-site Scripting | – | 2016-03-10 | – | 1 |
| Big Bug with Vault which i have already reported: Case #606962#65084 | Valid | Coinbase | No weakness recorded | – | 2016-01-20 | – | 1 |
| Xss via Dropbox#72526 | Valid | ThisData | Cross-site Scripting | – | 2016-03-07 | – | 1 |
| Time-Based Blind SQL Injection Attacks#78443 | No longer public | Mail.ru | SQL Injection | – | 2016-03-10 | – | 1 |
| information disclosure#78765 | Valid | Udemy | Information Disclosure | – | 2016-02-07 | – | 1 |
| Runtime manipulation iOS app breaking the PIN#80512 | Informative | Coinbase | Misconfiguration and Insecure Design | – | 2016-11-16 | – | 1 |
| apps.owncloud.com: Multiple reflected XSS by insecure URL generation (IE only)#83381 | Valid | ownCloud | Cross-site Scripting | – | 2016-03-10 | – | 1 |
| s2.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability#83855 | Valid | ownCloud | Cross-site Scripting | – | 2016-02-05 | – | 1 |
| s2.owncloud.com: SSL Session cookie without secure flag set#83856 | Valid | ownCloud | Information Disclosure | – | 2016-01-27 | – | 1 |
| *.owncloud.com / *.owncloud.org: Using not strong enough SSL ciphers#84078 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-05 | – | 1 |
| apps.owncloud.com: CSRF change privacy settings#85565 | Valid | ownCloud | Cross-Site Request Forgery | – | 2016-03-11 | – | 1 |
| Full Path Disclosure#87505 | Valid | ownCloud | Information Disclosure | – | 2016-01-06 | – | 1 |
| Apache documentation#90321 | Valid | ownCloud | Information Disclosure | – | 2016-01-04 | – | 1 |
| Attack User Privacy Settings - X-Frame-Options missing on m.imgur.com/user/username/settings#103178 | Valid | Imgur | Misconfiguration and Insecure Design | – | 2016-05-04 | – | 1 |
| URGENT - Subdomain Takeover in support.urbandictionary.com pointing to Zendesk#103432 | Valid | Urban Dictionary | Command and Code Injection | – | 2016-01-04 | – | 1 |
| many xss in widgets.shopifyapps.com#105659 | Valid | Shopify | Cross-site Scripting | – | 2016-02-04 | $500 | 1 |
| DOM Based XSS in Checkout#105688 | Valid | LeaseWeb | Cross-site Scripting | – | 2016-02-26 | $100 | 1 |
| reflected in xss#107358 | No longer public | Mail.ru | Cross-site Scripting | – | 2016-02-17 | – | 1 |
| [parapa.mail.ru] SQL Injection#109212 | No longer public | Mail.ru | SQL Injection | – | 2016-01-18 | $150 | 1 |
| Multiple vulnerabilities in mail.ru subdomains#109373 | No longer public | Mail.ru | Cross-site Scripting | – | 2016-01-27 | – | 1 |
| Information Exposure Through Directory Listing#110655 | Valid | ownCloud | Information Disclosure | – | 2016-01-14 | – | 1 |
| Legacy API exposes private video titles#111386 | Valid | Vimeo | Information Disclosure | – | 2016-02-10 | – | 1 |
| www.shopify.com XSS via third-party script#111475 | Valid | Shopify | Cross-site Scripting | – | 2016-02-01 | $500 | 1 |
| [allods.my.com] SSRF / XSPA#111950 | No longer public | Mail.ru | No weakness recorded | – | 2016-02-11 | $150 | 1 |
| grtp.co is vulnerable to http-vuln-cve2011-3192#112687 | Informative | Gratipay | Denial of Service | None | 2016-02-12 | – | 1 |
| WordPress Failure Notice page will generate arbitrary hyperlinks#112955 | Valid | withinsecurity | No weakness recorded | – | 2016-03-25 | – | 1 |
| No Any Kind of Protection on Delete account#113211 | Valid | ownCloud | Authentication | – | 2016-03-02 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.